CVE-2026-121970

Pay with Vipps and MobilePay for WooCommerce woo-vipps before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the...

CVE-2026-121970

The Pay with Vipps and MobilePay for WooCommerce (woo-vipps) plugin, in versions prior to 6.4.1 , is vulnerable to an improper cryptographic signature verification in the recurring-payment webhook handler . The root cause is that the code fails to exit when a local webhook secret is missing, inst...

EUVD-2026-116910

Pay with Vipps and MobilePay for WooCommerce woo-vipps before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the...

CVE-2026-121970 Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery

Pay with Vipps and MobilePay for WooCommerce woo-vipps before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the...

PT-2026-136968

Pay with Vipps and MobilePay for WooCommerce woo-vipps before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the...

CVE-2026-121970: wphostingdev Pay with Vipps and MobilePay for WooCommerce: Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature…

Pay with Vipps and MobilePay for WooCommerce woo-vipps before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the...

CVE-2026-119731: Petpooja Munshi: Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at…

Munshi by Petpooja before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the...

CVE-2026-103311

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

EUVD-2026-104095

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

PT-2026-117240

Name of the Vulnerable Software and Affected Versions Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin versions prior to 1.4.2 Description The plugin fails to verify the authenticity of incoming payment webhook notifications. This occurs because the shared secret used to validat...

CVE-2026-103311: Insufficient Verification of Data Authenticity

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

CVE-2026-87974

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers ...

CVE-2026-87974

The Asaas Gateway for WooCommerce WordPress plugin (versions before 2.7.8 ) is vulnerable to an unauthenticated order payment bypass via a webhook flaw. The plugin fails to properly authenticate its payment webhook by accepting an empty access token in its default configuration. Furthermore, it d...

EUVD-2026-100858

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers ...

CVE-2026-87974: Improper Authentication

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers ...

CVE-2026-103307: Improper Neutralization of Special Elements used in an SQL Command

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

PT-2026-113686

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers ...

EUVD-2026-95709

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

CVE-2026-103329: Improper Verification of Cryptographic Signature

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

PT-2026-108868

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...